Legal
Responsible disclosure
If you find a security problem in modelrailsim.com, we'd like to hear about it, and we'll treat you well for telling us.
How to report
Email contact@modelrailsim.com with the subject Security report. Tell us what you found, where (the page or API path), the steps to reproduce it, and what you think the impact is. A screenshot or a request and response help. You'll get a reply from a person within three working days.
What we ask
- Give us a reasonable time to fix the problem before you publish anything about it; we'll agree a date with you.
- Don't access, change or delete other people's data. If you come across it, stop and tell us.
- Don't run denial-of-service tests, spam, or social engineering against us or our users.
- Test only against accounts you created yourself.
What you can expect
- We won't take legal action against research done in good faith under the rules above.
- We'll tell you when the problem is fixed, and credit you on the credits page if you'd like.
- We don't run a paid bounty program; we do say thank you, and we may add AI Credit to your account.
In scope
modelrailsim.com and its API, the simulator and the Layout Designer, and the sign-in, account and payment flows. Out of scope: the third-party services we rely on (Cloudflare, Stripe, Anthropic, Google and Apple sign-in, Plausible), which have their own programs.
Last updated October 24, 2026.